popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

567jn7x.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 22, 2024, 9:27 a.m. July 22, 2024, 9:30 a.m.
Size 1.1MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 e8a1d35e54a6982c175c4351f3ce0dcd
SHA256 6565ab8e7be0d3e8544a49cb90e79715df0120d03c187ba9443ab738ca4dca28
CRC32 35F7BCB1
ssdeep 24576:Xi+H+khU6fKwnSQM1BQjo0ejcik51r/rwuMGRvot:Xq6fKwnSQM1OrCarzsGRI
PDB Path C:\bi47gaq4si\output.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\bi47gaq4si\output.pdb
section .textbss
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75
        

      
        exception.instruction:
        cmp dword ptr [esi], 0x64616f4c
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.symbol:
        
        

      
        exception.address:
        0x3801cb
        

      
    
  
    
      
        registers.esp:
        12910220
        

      
        registers.edi:
        1973072088
        

      
        registers.eax:
        1972830208
        

      
        registers.ebp:
        632
        

      
        registers.edx:
        1973069536
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        1973551114
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2540
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00380000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0003ba00', u'virtual_address': u'0x0012c000', u'entropy': 7.191114487456968, u'name': u'.data', u'virtual_size': u'0x0003d7cc'}
                                        
                                    
                                        
                                            entropy
                                            7.19111448746
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.21171770972
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Generic.4!c
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    Artemis!Trojan
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Gen:Heur.Kysler.1
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Trojan.Win32.Save.a
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Gen:Heur.Kysler.1
                                    
                                


                            

                        

                            

                                

                                    Cybereason
                                    malicious.e54a69
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Kysler.1
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/GenKryptik.GZUD
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!E8A1D35E54A6
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:DropperX-gen [Drp]
                                    
                                


                            

                        

                            

                                

                                    ClamAV
                                    Win.Packed.Injuke-10033459-0
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    Trojan-PSW.Win32.Stealerc.lrm
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Gen:Heur.Kysler.1
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.Generic!8.C3 (CLOUD)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Gen:Heur.Kysler.1 (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/AD.Stealc.ijlve
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Trojan.PWS.RedLineNET.9
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    TrojanSpy.Win32.STEALC.YXEGUZ
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    ti!6565AB8E7BE0
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.e8a1d35e54a6982c
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/Generic-S
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan.Win32.Krypt
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/AD.Stealc.ijlve
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=88)
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    Trojan/Win32.Wacatac
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    Win32.Troj.Unknown.a
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Ransom.Win32.Wacatac.sa
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Stealerc.GAB!MTB
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    Trojan-PSW.Win32.Stealerc.lrm
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Gen:Heur.Kysler.1
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Dropper/Win.Generic.R658793
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    BScope.TrojanPSW.Vidar
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Trojan.MalPack.RND
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/Chgt.AD
                                    
                                


                            

                        

                            

                                

                                    TrendMicro-HouseCall
                                    TrojanSpy.Win32.STEALC.YXEGUZ
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Malicious PE
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    PossibleThreat.PALLAS.H
                                    
                                


                            

                        

                            

                                

                                    AVG
                                    Win32:DropperX-gen [Drp]
                                    
                                


                            

                        

                            

                                

                                    Paloalto
                                    generic.ml
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_100% (W)
                                    
                                


                            

                        

                            

                                

                                    alibabacloud
                                    Trojan:Win/Kysler.Gen